Defaults.Exposed › October 2026 census › v10 registry › MIME-sniffing protection
MIME-sniffing protection
Methodology v10 · canonical ID x-content-type-options · Web Security · scored
Stops browsers mis-reading files in ways attackers can abuse.
MIME-sniffing protection: definition
| Canonical ID | x-content-type-options |
|---|---|
| Category | Web Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The site sends X-Content-Type-Options: nosniff. |
| Fail | The header is absent. |
| Example (passing) | X-Content-Type-Options: nosniff |
MIME-sniffing protection across the census
18.7% of domains whose page returned a 2xx response send X-Content-Type-Options: nosniff (24,795,503 of 132,559,479, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
MIME-sniffing protection is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 199,932,840 of the 332,492,319 graded domains had no determinable result for this check: the four response-header checks run only where the page returned a 2xx response; redirects, errors and unanswered fetches return N/A.
Every outcome in the census
| Outcome | Domains | Share of domains whose page returned a 2xx response | In the headline figure |
|---|---|---|---|
| X-Content-Type-Options: nosniff sent | 24,795,503 | 18.7% | Yes |
| Header absent | 107,763,976 | 81.3% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of domains whose page returned a 2xx response that send X-Content-Type-Options: nosniff by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 89,943,208 domains | 19.2% | .shop 36.4%, .app 30.0%, .dev 27.2% | .xyz 3.28%, .top 5.58%, .cfd 8.44% |
| Country-code TLDs (ccTLDs): 167 TLDs, 42,370,451 domains | 17.6% | .ai 36.2%, .kr 34.6%, .dk 30.0% | .cn 7.06%, .cc 7.84%, .xn--p1ai 9.32% |
The largest TLD in this base, .com, stands at 20.9% (12,194,110 of 58,295,711).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 132,313,659 of the 132,559,479 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 Web Security checks with a published figure, MIME-sniffing protection has the 3rd highest pass share. Next above it is HSTS (HTTP Strict Transport Security): 21.4% of HTTPS-serving domains. Next below it is Clickjacking protection: 15.9% of domains whose page returned a 2xx response. Across every check with a published figure it ranks 16th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix MIME-sniffing protection
Cite this check
Defaults.Exposed, "MIME-sniffing protection (x-content-type-options)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/x-content-type-options
Permalink: https://defaults.exposed/methodology/x-content-type-options ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data